chore: pin GitHub Actions dependencies

[jonathannorris]

Summary

• Pin GitHub Actions and third-party release actions to immutable commit SHAs.
• Keep the Node 24-compatible action versions introduced in chore: update GitHub Actions to Node 24 #96.

[Copilot]

Pull request overview

Pins GitHub Actions and third-party actions used by this repo’s CI/release workflows to immutable commit SHAs, aligning with supply-chain hardening while keeping the Node 24–compatible action lines introduced previously.

Changes:

• Pinned amannn/action-semantic-pull-request to a specific commit SHA.
• Pinned release workflow actions (actions/checkout, actions/setup-node, JS-DevTools/npm-publish, and DevCycle release actions) to specific commit SHAs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/semantic-pr.yml	Pins semantic PR title action to an immutable SHA.
.github/workflows/release.yml	Pins checkout/setup-node/publish/release actions to immutable SHAs for the release pipeline.

Suppressed comments (1)

.github/workflows/release.yml:53

• Same as above: # main is now inaccurate because the action reference is pinned to an immutable SHA. Update the comment to reflect the pinned revision (short SHA or tag) so future updates are less error-prone.

 - uses: DevCycleHQ/release-action/create-release@688bda29699196751db9da5f08430bf707fb4938 # main

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.